Différences

Ci-dessous, les différences entre deux révisions de la page.

--- linux:dns [2026/03/09 20:51] – add links about bind9 phsw
+++ linux:dns [2026/03/13 14:18] (Version actuelle) – [Unbound] add link about how to turn off dnssec phsw
@@ Ligne 42: / Ligne 42: @@
   * [[https://calomel.org/unbound_dns.html|Unbound DNS Tutorial]]
   * [[https://rtfm.co.ua/en/freebsd-home-nas-part-4-local-dns-with-unbound/|FreeBSD: Home NAS, part 4 – Local DNS with Unbound]]
+  * [[https://wiki.evolix.org/HowtoUnbound|Howto Unbound]]
+Unbound ne supporte pas le mécanisme ''NOTIFY'' pour transférer ses zones vers un serveur secondaire.
 === Gestion du cache ===
   * [[https://abridge2devnull.com/posts/2016/03/unbound-dns-server-cache-control/|Unbound DNS Server Cache Control]]
+  * [[https://www.nlnetlabs.nl/documentation/unbound/howto-turnoff-dnssec/|Howto Turn Off DNSSEC]]
 Afficher le cache DNS :
@@ Ligne 57: / Ligne 60: @@
 </code>
+=== Serveur faisant autorité ===
+  * [[https://www.aricodes.net/posts/unbound-authoritative-zone/|Using Unbound as an Authoritative Nameserver]]
+  * [[https://troubleshooters.com/linux/unbound_nsd/nsd.htm|NSD, an Authoritative Server to go with Unbound]]
+''/etc/unbound/unbound.conf'' :
+<code>
+server:
+    prefer-ip4: yes
+    do-ip4: yes
+    do-ip6: no
+    hide-identity: yes
+    hide-version: yes
+    prefetch: yes
+    tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
+forward-zone:
+    name: "."
+    forward-addr: 192.168.3.53@53
+auth-zone:
+  name: g1.t2
+  zonefile: /etc/unbound/g1.t2
+</code>
+''/etc/unbound/g1.t2'' :
+<code>
+$TTL    3600 ; 1 Hour
+$ORIGIN g1.t2.
+g1.t2. IN SOA g1.t2. hostmaster.g1.t2. (
+                              20250211 ; serial
+; refresh
+; retry
+; expire
+; minimum
+                             )
+@  1D  IN  NS g1.t2.
+ns.foo IN A 192.168.2.212
+foo IN NS ns.foo
+</code>
@@ Ligne 76: / Ligne 121: @@
   * [[https://github.com/0xCyberLiTech/DNS]]
   * [[https://www.it-connect.fr/dns-avec-bind-9/|Comment installer et configurer un serveur DNS Bind9 sur Debian ?]]
+=== Désactiver DNSSEC ===
+[[https://serverfault.com/questions/1058501/bind9-disable-dnssec-validation-on-per-zone-basis|Source]]
+<code>
+dnssec-validation no;
+</code>